PanamaCódigo Penal, Delitos contra la Seguridad Informática
In force.
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction, Security
- Audit expectation
- none
What it requires
- Do not improperly enter or use a database, network or computer system.
- Do not improperly seize, copy, use or modify data in transit or held in a database or computer system, or interfere with, intercept, obstruct or prevent its transmission.
- Expect an aggravated penalty if the data belongs to a public office, a public-service institution, a bank, insurer or other financial institution, or if the conduct is committed for profit or by someone authorized to access the system.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Two to four years' imprisonment under article 289 or 290, aggravated by a third to a sixth under article 291 for data held by public offices, public-service providers, banks, insurers or financial or securities institutions, or when committed for profit, and aggravated by a sixth to a third under article 292 when committed by the person in charge of, or authorized to access, the database or system.
What it makes you log
Logging duty
Articles 289 to 292 punish improper entry to or use of a database, network or computer system, improper taking, copying, use or modification of data, aggravations for public bodies, banks and similar targets, and aggravation for the person in charge of the system or an insider. None creates a duty to create, keep or produce a log or record. The cited articles carry no territorial clause.
- Kind
- None
- As of
What this law does
Article 289 sanctions with two to four years' imprisonment anyone who improperly enters or uses a database, network or computer system.
Article 290 imposes the same two-to-four-year range on anyone who improperly seizes, copies, uses or modifies data in transit or held in a database or computer system, or who interferes with, intercepts, obstructs or prevents its transmission; neither article conditions the offence on defeating a technical security measure, so a plain reading reaches unauthorized use of a public, unauthenticated page as well as a password-protected one.
Article 291 aggravates the penalty by a third to a sixth when the conduct targets data held by a public office, a public, private or mixed institution providing a public service, or a bank, insurer or other financial or securities institution, and aggravates it further when committed for profit.
Article 292 aggravates the penalty by a sixth to a third when the offender is the person in charge of the database or system, a person authorized to access it, or someone who used privileged information to commit the offence. The consolidated text carries an adoption date of for the compiled version, and no day on which these articles came into force has been located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .